Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
90 articles
Zebra.com suffered a critical ransomware breach by Clop, resulting in the exfiltration of 8TB of sensitive databases and CAD files. The incident severely impacted operations and data confidentiality.
Apple and Mac users suffered a critical ransomware incident after attackers exploited CVE-2026-65400 in macOS Screen Sharing to install Monero miners. The flaw enabled remote root access and unauthorized code execution on tens of thousands of devices.
An unnamed organization suffered a high-severity Akira ransomware attack in August 2026, involving credential-spraying against a SonicWall SSL VPN and Safe Mode EDR evasion. Data was exfiltrated and ransomware deployed, but encryption failed due to system constraints.
An unknown organization suffered a ransomware attack by an Akira affiliate, resulting in data and credential theft after EDR was disabled via Safe Mode, though encryption failed.
DeadLock ransomware compromised 80 organizations across Europe, stealing and encrypting sensitive data. The group leveraged blockchain and decentralized networks to evade takedown.
Four San Diego hospitals suffered a ransomware attack in 2021, crippling operations and causing severe patient care disruptions. The incident led to a 48% increase in wait times and a 128% rise in patients leaving without care.
Signature Services, a US-based professional services provider, suffered a ransomware attack attributed to the Play group, resulting in file encryption and operational disruption. The incident was publicly claimed by the attackers, though the organization has not confirmed details.
Preferred Financial Group suffered a ransomware attack attributed to the Play group, resulting in unauthorized access and operational disruption. The incident was publicly claimed by the threat actor, though the organization has not confirmed the breach.
Centro Universitário CESMAC in Brazil suffered a ransomware attack attributed to the krybit group, resulting in potential IT system encryption and service disruption. The incident was publicly claimed by the threat actor on their darknet blog.
naskdoorinc.com, a US-based manufacturing company, suffered a ransomware attack by the safepay group, causing operational disruption across southeastern Pennsylvania and northern Delaware. The incident may involve data encryption or theft, though technical specifics remain unconfirmed.
Minnesota water utilities suffered a coordinated ransomware attack impacting over 30 organizations, including Braham and Plymouth Water Utilities. Attackers exploited exposed PLCs, resulting in operational outages and boil water notices.
Vernon & Waldrep, a Texas-based healthcare organization, suffered a ransomware attack by Global Secret Group, resulting in the compromise of 274 GB of data. Over 56,000 files, including sensitive healthcare and mental health specialist information, were exposed.